@caelo-cms/provisioning 0.10.44 → 0.10.47

package/dist/upgrade/converge.js

@@ -0,0 +1,287 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * The converge half of an upgrade (epic #696): everything that changes IAM,
+ * service accounts, secrets or other cloud resources so the install matches
+ * what the release's stacks declare — the gateway's run SA and the
+ * CLI-generated runtime secrets, the stack's IAM/CDN/firewall invariants,
+ * MCP access through IAP, the gateway's and public_role's database logins,
+ * the operator-access sync job, and dropping bindings nothing reads any more.
+ *
+ * It needs the rights of whoever provisioned the install, so only
+ * `cms-provision upgrade` (the operator's own identity) runs it — never the
+ * in-cloud upgrader job, which only app-rolls and refuses while
+ * {@link needsConverge} says the install is behind.
+ *
+ * The keyless-provisioner step (#696, provisioner-identity.ts) is converge
+ * too; it needs the operator's local install dir, so the CLI injects it as
+ * {@link ConvergeDeps.provisionerIdentity}.
+ *
+ * Some steps must sit between app-roll steps (a role migration 0248 creates
+ * gets its password after migrations, before the gateway rolls onto it), so
+ * a converge is a {@link ConvergeSession}: a part before the app-roll, the
+ * {@link AppRollHooks} the app-roll calls in between, and a part after it.
+ */
+import { ensureGatewayRolePassword, findSqlInstance, planPublicRoleSwitch, } from "../gateway-credentials.js";
+import { ensureMcpIapAccess } from "../mcp-iap.js";
+import { ensureOperatorAccessSync, resolveOperatorAccessTarget } from "../operator-access.js";
+import { ensureGatewayServiceAccount, ensureGeneratedSecrets, plainGeneratedSecretSeed, readSecretReplication, } from "../runtime-secrets.js";
+import { selfCommand } from "../self-command.js";
+import { MCP_ENV_VAR, OPERATOR_ACCESS_JOB_ENV_VAR } from "../stack-contract.js";
+import { ensureStackInvariants, liveEnvHasInlinePassword, removeRetiredIamBindings, } from "../stack-converge.js";
+/**
+ * Whether the install must converge before an app-roll to a release that
+ * expects infrastructure contract `targetVersion` (infra-contract.ts). An
+ * install with no recorded version has never completed a converge under
+ * this scheme and always needs one.
+ */
+export function needsConverge(install, targetVersion) {
+    return (install.infraContractVersion ?? 0) < targetVersion;
+}
+/** Start a converge for the install `plan` rolls. */
+export function startConverge(plan, ownerEmail, deps) {
+    const { install } = plan;
+    const { reporter: r, run } = deps;
+    const runDeps = { run, ...(deps.sleep ? { sleep: deps.sleep } : {}) };
+    const service = (slug) => plan.services.find((s) => s.slug === slug);
+    const services = { admin: service("admin").serviceName, gateway: service("gateway").serviceName };
+    const target = {
+        provider: install.provider,
+        projectId: install.projectId,
+        region: install.region,
+        env: install.env,
+        services,
+    };
+    let incomplete = false;
+    // Env vars the rolls must leave as the services have them, because the
+    // thing they point at could not be set up.
+    const leaveUntouched = [];
+    let publicRole = null;
+    async function runtimeIdentities() {
+        // The gateway's own run SA and the CLI-generated secrets the env
+        // contract references. Created once, never overwritten; must exist
+        // before the invariants bind them and the rolls reference them.
+        const s = r.step("Ensuring the gateway service account + generated runtime secrets...");
+        const secretsTarget = { projectId: install.projectId, env: install.env };
+        const replication = await readSecretReplication(secretsTarget, runDeps);
+        const outcomes = [
+            await ensureGatewayServiceAccount(secretsTarget, runDeps),
+            ...(replication.ok
+                ? await ensureGeneratedSecrets({
+                    ...secretsTarget,
+                    region: install.region,
+                    replication: replication.replication,
+                    seed: plainGeneratedSecretSeed(service("admin").liveEnv),
+                }, runDeps)
+                : [{ id: "secret replication", status: "failed", error: replication.error }]),
+        ];
+        const failed = outcomes.filter((o) => o.status === "failed");
+        if (failed.length > 0) {
+            s.failed("Runtime identities/secrets could not be ensured. Aborting upgrade.");
+            for (const o of failed)
+                r.error(`  FAILED: ${o.id}\n    ${o.error ?? ""}`);
+            r.warn("No traffic was shifted and no migrations ran. Fix the above and re-run.");
+            return false;
+        }
+        s.done("Gateway service account + runtime secrets ok");
+        for (const o of outcomes.filter((o) => o.status === "applied")) {
+            r.info(`  created: ${o.id}${o.detail ? ` (${o.detail})` : ""}`);
+        }
+        return true;
+    }
+    async function stackInvariants() {
+        // IAM bindings + CDN policy added to the stacks after this install was
+        // provisioned (stack-contract.ts), and GCP's SSH/RDP-from-anywhere
+        // firewall rules removed (default-firewall.ts). Additive + idempotent.
+        const s = r.step("Ensuring the IAM bindings + CDN settings the stack declares, removing the default network's pre-populated firewall rules...");
+        const report = await ensureStackInvariants(target, runDeps);
+        const applied = report.outcomes.filter((o) => o.status === "applied");
+        const failed = report.outcomes.filter((o) => o.status === "failed");
+        if (report.mustAbort)
+            s.failed("Stack invariants could not be ensured. Aborting upgrade.");
+        else {
+            s.done(`Stack invariants ok (${report.outcomes.length - failed.length}/${report.outcomes.length}, ${applied.length} applied)`);
+        }
+        for (const o of applied)
+            r.info(`  applied: ${o.id} (${o.why})`);
+        for (const o of failed) {
+            const line = `  ${o.onFailure === "abort" ? "FAILED" : "not applied"}: ${o.id} — ${o.why}\n    ${o.error ?? ""}`;
+            if (o.onFailure === "abort")
+                r.error(line);
+            else
+                r.warn(line);
+        }
+        if (failed.length > 0)
+            incomplete = true;
+        if (report.mustAbort) {
+            r.warn("No traffic was shifted and no migrations ran. Fix the bindings above and re-run.");
+            return false;
+        }
+        return true;
+    }
+    async function mcpAccess() {
+        // Issue #37 — the MCP service account + its IAP/token-creator bindings.
+        // Also what the deep health check signs its IAP credential as. A failure
+        // costs MCP access, so it warns and the admin keeps its current value.
+        const s = r.step("Ensuring MCP access through IAP...");
+        // Signing as the MCP account goes through the IAM Credentials API, which
+        // installs from before #678 may not have enabled.
+        const api = await run([
+            "services",
+            "enable",
+            "iamcredentials.googleapis.com",
+            `--project=${install.projectId}`,
+        ]);
+        const resource = api.ok ? await adminIapResource() : null;
+        const mcp = !api.ok
+            ? {
+                ok: false,
+                error: `enable the IAM Credentials API (iamcredentials.googleapis.com): ${api.stderr.trim()}`,
+            }
+            : resource
+                ? await ensureMcpIapAccess({ projectId: install.projectId, resource, ...runDeps })
+                : { ok: false, error: "admin IAP backend service not found" };
+        if (mcp.ok) {
+            s.done(`MCP access ready (${mcp.serviceAccount}; ${mcp.operators.length} operator(s))`);
+            return;
+        }
+        s.warned(`MCP access not configured: ${mcp.error}`);
+        r.warn("The upgrade continues; external MCP clients stay blocked by IAP until this succeeds.");
+        incomplete = true;
+        leaveUntouched.push(MCP_ENV_VAR);
+    }
+    /** The admin's IAP resource: the service on gcp-firebase, the LB backend on gcp. */
+    async function adminIapResource() {
+        if (install.provider === "gcp-firebase") {
+            return { kind: "cloud-run", service: services.admin, region: install.region };
+        }
+        const res = await run([
+            "compute",
+            "backend-services",
+            "list",
+            "--global",
+            `--project=${install.projectId}`,
+            `--filter=name~^caelo-${install.env}-admin-backend`,
+            "--format=value(name)",
+        ]);
+        const name = res.ok ? res.stdout.trim().split("\n")[0]?.trim() : "";
+        return name ? { kind: "backend-services", service: name } : null;
+    }
+    async function databaseLogins() {
+        // #613 — migration 0248 creates gateway_role without a password; it gets
+        // its secret's value before the gateway rolls onto it. public_role
+        // moves onto its own password right before the gateway's roll.
+        const s = r.step("Ensuring the gateway's database login (gateway_role)...");
+        const sqlInstance = await findSqlInstance(install, { run });
+        if (!sqlInstance) {
+            s.failed("Could not find the Cloud SQL instance. Aborting upgrade.");
+            r.warn("Migrations ran; no traffic was shifted. Re-run upgrade once the instance is found.");
+            return false;
+        }
+        const roleTarget = { projectId: install.projectId, env: install.env, sqlInstance };
+        const roleDeps = { ...runDeps, ...(deps.http ? { http: deps.http } : {}) };
+        const gatewayRole = await ensureGatewayRolePassword(roleTarget, roleDeps);
+        if (gatewayRole.status === "failed") {
+            s.failed("gateway_role could not be given its password. Aborting upgrade.");
+            r.error(`  ${gatewayRole.error ?? ""}`);
+            r.warn("Migrations ran (0248 creates gateway_role); no traffic was shifted. Fix the above and re-run upgrade.");
+            return false;
+        }
+        s.done("gateway_role ready");
+        publicRole = planPublicRoleSwitch(roleTarget, service("gateway").liveEnv, roleDeps);
+        return true;
+    }
+    async function operatorAccess() {
+        // The job that keeps IAP in step with the user list (operator-access.ts).
+        // After migrations: its database user gets the role migration 0239
+        // creates. A failure only costs IAP following the user list, so it warns.
+        const s = r.step("Ensuring the operator-access sync job...");
+        const resolved = await resolveOperatorAccessTarget({
+            provider: install.provider,
+            projectId: install.projectId,
+            region: install.region,
+            env: install.env,
+            ownerEmail,
+            imageRef: service("admin").imageRef,
+        }, { run });
+        const oa = resolved.ok
+            ? await ensureOperatorAccessSync(resolved.target, runDeps)
+            : { ok: false, done: [], error: resolved.error };
+        for (const step of oa.done)
+            r.info(`  ${step}`);
+        if (oa.ok) {
+            s.done("Operator-access sync job ready (IAP follows the user list)");
+            return;
+        }
+        s.warned(`Operator-access sync job not set up: ${oa.error}`);
+        r.warn("The upgrade continues; user changes will report that Google IAP could not be updated until this succeeds. Re-run upgrade once the cause is fixed.");
+        incomplete = true;
+        leaveUntouched.push(OPERATOR_ACCESS_JOB_ENV_VAR);
+    }
+    return {
+        async beforeAppRoll() {
+            if (deps.provisionerIdentity && !(await deps.provisionerIdentity()))
+                return false;
+            if (!(await runtimeIdentities()))
+                return false;
+            if (!(await stackInvariants()))
+                return false;
+            await mcpAccess();
+            return true;
+        },
+        hooks: {
+            async afterMigrations() {
+                if (!(await databaseLogins()))
+                    return { ok: false };
+                await operatorAccess();
+                return { ok: true, leaveUntouched: [...leaveUntouched] };
+            },
+            async beforeRoll(slug) {
+                if (slug !== "gateway" || !publicRole)
+                    return { ok: true };
+                const moved = await publicRole.beforeGatewayRoll();
+                return moved.status === "failed"
+                    ? {
+                        ok: false,
+                        error: `public_role could not be moved onto its own password: ${moved.error ?? ""}`,
+                    }
+                    : { ok: true };
+            },
+            async afterRollback(slug) {
+                // The prior gateway revision reads public_role's old password.
+                if (slug !== "gateway" || !publicRole)
+                    return;
+                const outcome = await publicRole.afterGatewayRollFailed();
+                if (outcome.startsWith("could NOT"))
+                    r.error(`  ${outcome}`);
+                else
+                    r.info(`  ${outcome}`);
+            },
+        },
+        async afterAppRoll() {
+            // #613 — with both services on their new revisions, drop the bindings
+            // nothing reads through any more (above all the gateway SA's access to
+            // admin_role's password). Loud on failure.
+            const retired = await removeRetiredIamBindings(target, runDeps);
+            for (const o of retired) {
+                if (o.status === "removed")
+                    r.info(`  removed: ${o.id} (${o.why})`);
+                if (o.status === "failed") {
+                    incomplete = true;
+                    r.error(`  NOT removed: ${o.id} — ${o.why}\n    ${o.error ?? ""}\n    Re-run upgrade with an account that may change IAM, or remove the binding by hand.`);
+                }
+            }
+            if (publicRole?.moves) {
+                // Until this upgrade the gateway held admin_role's password; anyone
+                // who ever compromised it could have kept a copy.
+                r.warn(`The gateway no longer holds admin_role's password, but it did until now. Rotate it: ${selfCommand("rotate-secret", "postgres-password", "--install", install.domain)}`);
+            }
+            if (plan.services.some((s) => liveEnvHasInlinePassword(s.liveEnv))) {
+                // The services moved their database password to Secret Manager, but
+                // every earlier revision still shows it in its env.
+                r.warn(`The database password was stored in plain env vars before this upgrade and stays readable in the services' old revisions. Rotate it now: ${selfCommand("rotate-secret", "postgres-password", "--install", install.domain)}`);
+            }
+        },
+        complete: () => !incomplete,
+    };
+}
+//# sourceMappingURL=converge.js.map

package/dist/upgrade/converge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"converge.js","sourceRoot":"","sources":["../../src/upgrade/converge.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAEnC;;;;;;;;;;;;;;;;;;;;;GAqBG;AAEH,OAAO,EACL,yBAAyB,EACzB,eAAe,EACf,oBAAoB,GACrB,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EAAE,kBAAkB,EAAoB,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,wBAAwB,EAAE,2BAA2B,EAAE,MAAM,uBAAuB,CAAC;AAC9F,OAAO,EACL,2BAA2B,EAC3B,sBAAsB,EAEtB,wBAAwB,EACxB,qBAAqB,GACtB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,wBAAwB,GACzB,MAAM,sBAAsB,CAAC;AAI9B;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAC3B,OAAsD,EACtD,aAAqB;IAErB,OAAO,CAAC,OAAO,CAAC,oBAAoB,IAAI,CAAC,CAAC,GAAG,aAAa,CAAC;AAC7D,CAAC;AAkCD,qDAAqD;AACrD,MAAM,UAAU,aAAa,CAC3B,IAAiB,EACjB,UAAkB,EAClB,IAAkB;IAElB,MAAM,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;IAClC,MAAM,OAAO,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACtE,MAAM,OAAO,GAAG,CAAC,IAAc,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAa,CAAC;IAC3F,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,CAAC;IAClG,MAAM,MAAM,GAAG;QACb,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,GAAG,EAAE,OAAO,CAAC,GAAG;QAChB,QAAQ;KACT,CAAC;IACF,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,uEAAuE;IACvE,2CAA2C;IAC3C,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,IAAI,UAAU,GAAmD,IAAI,CAAC;IAEtE,KAAK,UAAU,iBAAiB;QAC9B,iEAAiE;QACjE,mEAAmE;QACnE,gEAAgE;QAChE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,qEAAqE,CAAC,CAAC;QACxF,MAAM,aAAa,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;QACzE,MAAM,WAAW,GAAG,MAAM,qBAAqB,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG;YACf,MAAM,2BAA2B,CAAC,aAAa,EAAE,OAAO,CAAC;YACzD,GAAG,CAAC,WAAW,CAAC,EAAE;gBAChB,CAAC,CAAC,MAAM,sBAAsB,CAC1B;oBACE,GAAG,aAAa;oBAChB,MAAM,EAAE,OAAO,CAAC,MAAM;oBACtB,WAAW,EAAE,WAAW,CAAC,WAAW;oBACpC,IAAI,EAAE,wBAAwB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC;iBACzD,EACD,OAAO,CACR;gBACH,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,oBAAoB,EAAE,MAAM,EAAE,QAAiB,EAAE,KAAK,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC,CAAC;SACzF,CAAC;QACF,MAAM,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QAC7D,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACtB,CAAC,CAAC,MAAM,CAAC,oEAAoE,CAAC,CAAC;YAC/E,KAAK,MAAM,CAAC,IAAI,MAAM;gBAAE,CAAC,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;YAC3E,CAAC,CAAC,IAAI,CAAC,yEAAyE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAC;QACvD,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,EAAE,CAAC;YAC/D,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,eAAe;QAC5B,uEAAuE;QACvE,mEAAmE;QACnE,uEAAuE;QACvE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CACd,6HAA6H,CAC9H,CAAC;QACF,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;QAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC;QACtE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC;QACpE,IAAI,MAAM,CAAC,SAAS;YAAE,CAAC,CAAC,MAAM,CAAC,0DAA0D,CAAC,CAAC;aACtF,CAAC;YACJ,CAAC,CAAC,IAAI,CACJ,wBAAwB,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,WAAW,CACvH,CAAC;QACJ,CAAC;QACD,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;QACjE,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,aAAa,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC;YACjH,IAAI,CAAC,CAAC,SAAS,KAAK,OAAO;gBAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;;gBACtC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QACD,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,UAAU,GAAG,IAAI,CAAC;QACzC,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,CAAC,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC;YAC3F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,SAAS;QACtB,wEAAwE;QACxE,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAC;QACvD,yEAAyE;QACzE,kDAAkD;QAClD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;YACpB,UAAU;YACV,QAAQ;YACR,+BAA+B;YAC/B,aAAa,OAAO,CAAC,SAAS,EAAE;SACjC,CAAC,CAAC;QACH,MAAM,QAAQ,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,EAAE;YACjB,CAAC,CAAC;gBACE,EAAE,EAAE,KAAc;gBAClB,KAAK,EAAE,mEAAmE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE;aAC9F;YACH,CAAC,CAAC,QAAQ;gBACR,CAAC,CAAC,MAAM,kBAAkB,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,QAAQ,EAAE,GAAG,OAAO,EAAE,CAAC;gBAClF,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,KAAK,EAAE,qCAAqC,EAAE,CAAC;QAC3E,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;YACX,CAAC,CAAC,IAAI,CAAC,qBAAqB,GAAG,CAAC,cAAc,KAAK,GAAG,CAAC,SAAS,CAAC,MAAM,eAAe,CAAC,CAAC;YACxF,OAAO;QACT,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,8BAA8B,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,IAAI,CAAC,sFAAsF,CAAC,CAAC;QAC/F,UAAU,GAAG,IAAI,CAAC;QAClB,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IACnC,CAAC;IAED,oFAAoF;IACpF,KAAK,UAAU,gBAAgB;QAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,cAAc,EAAE,CAAC;YACxC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;QAChF,CAAC;QACD,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC;YACpB,SAAS;YACT,kBAAkB;YAClB,MAAM;YACN,UAAU;YACV,aAAa,OAAO,CAAC,SAAS,EAAE;YAChC,wBAAwB,OAAO,CAAC,GAAG,gBAAgB;YACnD,sBAAsB;SACvB,CAAC,CAAC;QACH,MAAM,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACpE,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACnE,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,yEAAyE;QACzE,mEAAmE;QACnE,+DAA+D;QAC/D,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;QAC5E,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,CAAC,CAAC,MAAM,CAAC,0DAA0D,CAAC,CAAC;YACrE,CAAC,CAAC,IAAI,CAAC,oFAAoF,CAAC,CAAC;YAC7F,OAAO,KAAK,CAAC;QACf,CAAC;QACD,MAAM,UAAU,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,WAAW,EAAE,CAAC;QACnF,MAAM,QAAQ,GAAG,EAAE,GAAG,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;QAC3E,MAAM,WAAW,GAAG,MAAM,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QAC1E,IAAI,WAAW,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YACpC,CAAC,CAAC,MAAM,CAAC,iEAAiE,CAAC,CAAC;YAC5E,CAAC,CAAC,KAAK,CAAC,KAAK,WAAW,CAAC,KAAK,IAAI,EAAE,EAAE,CAAC,CAAC;YACxC,CAAC,CAAC,IAAI,CACJ,uGAAuG,CACxG,CAAC;YACF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC;QAC7B,UAAU,GAAG,oBAAoB,CAAC,UAAU,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACpF,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,UAAU,cAAc;QAC3B,0EAA0E;QAC1E,mEAAmE;QACnE,0EAA0E;QAC1E,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,0CAA0C,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAChD;YACE,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,SAAS,EAAE,OAAO,CAAC,SAAS;YAC5B,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,GAAG,EAAE,OAAO,CAAC,GAAG;YAChB,UAAU;YACV,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,QAAQ;SACpC,EACD,EAAE,GAAG,EAAE,CACR,CAAC;QACF,MAAM,EAAE,GAAG,QAAQ,CAAC,EAAE;YACpB,CAAC,CAAC,MAAM,wBAAwB,CAAC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;YAC1D,CAAC,CAAC,EAAE,EAAE,EAAE,KAAc,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,QAAQ,CAAC,KAAK,EAAE,CAAC;QAC5D,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,IAAI;YAAE,CAAC,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;YACV,CAAC,CAAC,IAAI,CAAC,4DAA4D,CAAC,CAAC;YACrE,OAAO;QACT,CAAC;QACD,CAAC,CAAC,MAAM,CAAC,wCAAwC,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC;QAC7D,CAAC,CAAC,IAAI,CACJ,mJAAmJ,CACpJ,CAAC;QACF,UAAU,GAAG,IAAI,CAAC;QAClB,cAAc,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;IACnD,CAAC;IAED,OAAO;QACL,KAAK,CAAC,aAAa;YACjB,IAAI,IAAI,CAAC,mBAAmB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,mBAAmB,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAClF,IAAI,CAAC,CAAC,MAAM,iBAAiB,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC/C,IAAI,CAAC,CAAC,MAAM,eAAe,EAAE,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC7C,MAAM,SAAS,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC;QACd,CAAC;QAED,KAAK,EAAE;YACL,KAAK,CAAC,eAAe;gBACnB,IAAI,CAAC,CAAC,MAAM,cAAc,EAAE,CAAC;oBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;gBACpD,MAAM,cAAc,EAAE,CAAC;gBACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,GAAG,cAAc,CAAC,EAAE,CAAC;YAC3D,CAAC;YACD,KAAK,CAAC,UAAU,CAAC,IAAI;gBACnB,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU;oBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;gBAC3D,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,iBAAiB,EAAE,CAAC;gBACnD,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ;oBAC9B,CAAC,CAAC;wBACE,EAAE,EAAE,KAAK;wBACT,KAAK,EAAE,yDAAyD,KAAK,CAAC,KAAK,IAAI,EAAE,EAAE;qBACpF;oBACH,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;YACnB,CAAC;YACD,KAAK,CAAC,aAAa,CAAC,IAAI;gBACtB,+DAA+D;gBAC/D,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,UAAU;oBAAE,OAAO;gBAC9C,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,sBAAsB,EAAE,CAAC;gBAC1D,IAAI,OAAO,CAAC,UAAU,CAAC,WAAW,CAAC;oBAAE,CAAC,CAAC,KAAK,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;;oBACxD,CAAC,CAAC,IAAI,CAAC,KAAK,OAAO,EAAE,CAAC,CAAC;YAC9B,CAAC;SACF;QAED,KAAK,CAAC,YAAY;YAChB,sEAAsE;YACtE,uEAAuE;YACvE,2CAA2C;YAC3C,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChE,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;gBACxB,IAAI,CAAC,CAAC,MAAM,KAAK,SAAS;oBAAE,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;gBACpE,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;oBAC1B,UAAU,GAAG,IAAI,CAAC;oBAClB,CAAC,CAAC,KAAK,CACL,kBAAkB,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC,KAAK,IAAI,EAAE,0FAA0F,CAClJ,CAAC;gBACJ,CAAC;YACH,CAAC;YACD,IAAI,UAAU,EAAE,KAAK,EAAE,CAAC;gBACtB,oEAAoE;gBACpE,kDAAkD;gBAClD,CAAC,CAAC,IAAI,CACJ,uFAAuF,WAAW,CAAC,eAAe,EAAE,mBAAmB,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CACxK,CAAC;YACJ,CAAC;YACD,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,wBAAwB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;gBACnE,oEAAoE;gBACpE,oDAAoD;gBACpD,CAAC,CAAC,IAAI,CACJ,4IAA4I,WAAW,CAAC,eAAe,EAAE,mBAAmB,EAAE,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAC7N,CAAC;YACJ,CAAC;QACH,CAAC;QAED,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,UAAU;KAC5B,CAAC;AACJ,CAAC"}

package/dist/upgrade/gcp-lookup.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Read-only lookups of a deployed GCP install, plus the one traffic move an
+ * app-roll needs to undo itself. Every function takes the {@link GcloudRunner}
+ * it runs through, so the upgrade phases can be driven by a fake in tests and
+ * by a different identity in the in-cloud upgrader job (epic #696).
+ */
+import type { GcloudRunner } from "../gcloud-retry.js";
+/**
+ * Pulumi auto-naming appends a random 7-char suffix to every resource
+ * (e.g. `caelo-production-admin-3efcfea`), so lifecycle commands find the
+ * deployed name by prefix. Returns the first match, or null when the listing
+ * fails or finds nothing.
+ */
+export declare function resolveGcpResourceName(run: GcloudRunner, kind: "run-service" | "sql-instance", prefix: string, projectId: string, region?: string): Promise<string | null>;
+/** The deployed service as `gcloud run services describe --format=json` returns it. */
+export declare function describeServiceJson(run: GcloudRunner, projectId: string, region: string, serviceName: string): Promise<string | null>;
+/** The revision serving traffic now, so a failed roll can go back to it. */
+export declare function findCurrentRevision(run: GcloudRunner, projectId: string, region: string, serviceName: string): Promise<string | null>;
+/** The service's own `run.app` URL. */
+export declare function findServiceUrl(run: GcloudRunner, projectId: string, region: string, serviceName: string): Promise<string | null>;
+/** Pin all of a service's traffic to `revision`. */
+export declare function pinTraffic(run: GcloudRunner, projectId: string, region: string, serviceName: string, revision: string): Promise<boolean>;
+//# sourceMappingURL=gcp-lookup.d.ts.map

package/dist/upgrade/gcp-lookup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-lookup.d.ts","sourceRoot":"","sources":["../../src/upgrade/gcp-lookup.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAEvD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAAG,cAAc,EACpC,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,MAAM,CAAC,EAAE,MAAM,GACd,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAiCxB;AAsBD,uFAAuF;AACvF,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGxB;AAED,4EAA4E;AAC5E,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB;AAED,uCAAuC;AACvC,wBAAsB,cAAc,CAClC,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAIxB;AAED,oDAAoD;AACpD,wBAAsB,UAAU,CAC9B,GAAG,EAAE,YAAY,EACjB,SAAS,EAAE,MAAM,EACjB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE,MAAM,EACnB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,OAAO,CAAC,CAelB"}

package/dist/upgrade/gcp-lookup.js

@@ -0,0 +1,95 @@
+// SPDX-License-Identifier: MPL-2.0
+/**
+ * Pulumi auto-naming appends a random 7-char suffix to every resource
+ * (e.g. `caelo-production-admin-3efcfea`), so lifecycle commands find the
+ * deployed name by prefix. Returns the first match, or null when the listing
+ * fails or finds nothing.
+ */
+export async function resolveGcpResourceName(run, kind, prefix, projectId, region) {
+    const args = kind === "run-service"
+        ? [
+            "run",
+            "services",
+            "list",
+            "--region",
+            requiredRegion(region),
+            "--project",
+            projectId,
+            "--filter",
+            `metadata.name~^${prefix}`,
+            "--format=value(metadata.name)",
+        ]
+        : [
+            "sql",
+            "instances",
+            "list",
+            "--project",
+            projectId,
+            "--filter",
+            `name~^${prefix}`,
+            "--format=value(name)",
+        ];
+    const r = await run(args);
+    if (!r.ok)
+        return null;
+    return (r.stdout
+        .split("\n")
+        .map((s) => s.trim())
+        .find((s) => s.length > 0) ?? null);
+}
+/** A Cloud Run lookup is regional; there is no default region to guess. */
+function requiredRegion(region) {
+    if (!region)
+        throw new Error("a Cloud Run lookup needs the install region (install.json)");
+    return region;
+}
+function describeArgs(serviceName, region, projectId, format) {
+    return [
+        "run",
+        "services",
+        "describe",
+        serviceName,
+        "--region",
+        region,
+        "--project",
+        projectId,
+        `--format=${format}`,
+    ];
+}
+/** The deployed service as `gcloud run services describe --format=json` returns it. */
+export async function describeServiceJson(run, projectId, region, serviceName) {
+    const r = await run(describeArgs(serviceName, region, projectId, "json"));
+    return r.ok ? r.stdout : null;
+}
+/** The revision serving traffic now, so a failed roll can go back to it. */
+export async function findCurrentRevision(run, projectId, region, serviceName) {
+    const r = await run(describeArgs(serviceName, region, projectId, "value(status.traffic[0].revisionName)"));
+    if (!r.ok)
+        return null;
+    return r.stdout.trim().split("\n")[0]?.trim() || null;
+}
+/** The service's own `run.app` URL. */
+export async function findServiceUrl(run, projectId, region, serviceName) {
+    const r = await run(describeArgs(serviceName, region, projectId, "value(status.url)"));
+    if (!r.ok)
+        return null;
+    return r.stdout.trim() || null;
+}
+/** Pin all of a service's traffic to `revision`. */
+export async function pinTraffic(run, projectId, region, serviceName, revision) {
+    const r = await run([
+        "run",
+        "services",
+        "update-traffic",
+        serviceName,
+        "--region",
+        region,
+        "--project",
+        projectId,
+        "--to-revisions",
+        `${revision}=100`,
+        "--quiet",
+    ]);
+    return r.ok;
+}
+//# sourceMappingURL=gcp-lookup.js.map

package/dist/upgrade/gcp-lookup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gcp-lookup.js","sourceRoot":"","sources":["../../src/upgrade/gcp-lookup.ts"],"names":[],"mappings":"AAAA,mCAAmC;AAWnC;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAC1C,GAAiB,EACjB,IAAoC,EACpC,MAAc,EACd,SAAiB,EACjB,MAAe;IAEf,MAAM,IAAI,GACR,IAAI,KAAK,aAAa;QACpB,CAAC,CAAC;YACE,KAAK;YACL,UAAU;YACV,MAAM;YACN,UAAU;YACV,cAAc,CAAC,MAAM,CAAC;YACtB,WAAW;YACX,SAAS;YACT,UAAU;YACV,kBAAkB,MAAM,EAAE;YAC1B,+BAA+B;SAChC;QACH,CAAC,CAAC;YACE,KAAK;YACL,WAAW;YACX,MAAM;YACN,WAAW;YACX,SAAS;YACT,UAAU;YACV,SAAS,MAAM,EAAE;YACjB,sBAAsB;SACvB,CAAC;IACR,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1B,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CACL,CAAC,CAAC,MAAM;SACL,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,CACrC,CAAC;AACJ,CAAC;AAED,2EAA2E;AAC3E,SAAS,cAAc,CAAC,MAA0B;IAChD,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;IAC3F,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,WAAmB,EAAE,MAAc,EAAE,SAAiB,EAAE,MAAc;IAC1F,OAAO;QACL,KAAK;QACL,UAAU;QACV,UAAU;QACV,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,YAAY,MAAM,EAAE;KACrB,CAAC;AACJ,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AAChC,CAAC;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,GAAG,CACjB,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,uCAAuC,CAAC,CACtF,CAAC;IACF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC;AACxD,CAAC;AAED,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB;IAEnB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,CAAC,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IACvB,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;AACjC,CAAC;AAED,oDAAoD;AACpD,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,GAAiB,EACjB,SAAiB,EACjB,MAAc,EACd,WAAmB,EACnB,QAAgB;IAEhB,MAAM,CAAC,GAAG,MAAM,GAAG,CAAC;QAClB,KAAK;QACL,UAAU;QACV,gBAAgB;QAChB,WAAW;QACX,UAAU;QACV,MAAM;QACN,WAAW;QACX,SAAS;QACT,gBAAgB;QAChB,GAAG,QAAQ,MAAM;QACjB,SAAS;KACV,CAAC,CAAC;IACH,OAAO,CAAC,CAAC,EAAE,CAAC;AACd,CAAC"}

package/dist/upgrade/health.d.ts

@@ -0,0 +1,99 @@
+/**
+ * Deep health check after an app-roll (epic #696).
+ *
+ * Cloud Run's readiness only proves the new container listens on its port. A
+ * revision can do that while it cannot reach the database, runs against a
+ * schema its migrations never reached, or is not the release the roll asked
+ * for. After both services moved, the app-roll asks them:
+ *
+ *   - admin   `GET /_caelo/health?deep=1` → `{ ok, version, migrations }`:
+ *             both databases reachable as the expected roles, and every
+ *             migration the image ships recorded as applied.
+ *   - gateway `GET /api/_caelo/health?deep=1` → `{ ok, version }`: its
+ *             database logins work. Under `/api/` because that is the only
+ *             path the gcp load balancer routes to the gateway.
+ *
+ * Both answer with no secrets and no raw database errors. The admin sits
+ * behind IAP, so the probe signs an IAP credential as the install's MCP
+ * service account (`caelo-mcp@`, mcp-iap.ts) exactly like the MCP shim does
+ * (packages/mcp-server/src/ingress-auth.ts): a JWT with `aud` = the admin
+ * origin + `/*`, signed through the IAM Credentials API by whoever runs the
+ * upgrade (the converge step lets every IAP-allowlisted operator sign as
+ * that account). The gateway is public by design and gets no credential.
+ *
+ * Before anything changes, {@link HealthProbe.baseline} proves the probe can
+ * reach both services at all. Otherwise a DNS, certificate or IAP problem
+ * would only show after migrations, as a "failed" health check that rolls a
+ * healthy release back.
+ */
+import type { GcloudRunner, Sleep } from "../gcloud-retry.js";
+import type { HttpFetch } from "../runtime-secrets.js";
+export type HealthOutcome = {
+    readonly ok: true;
+    readonly detail: string;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+export interface HealthProbe {
+    /** Reach both services as they serve now (before any change). */
+    baseline(): Promise<HealthOutcome>;
+    /**
+     * Deep-check both services after the roll, retrying while the new
+     * revisions warm up. `version` is the release the roll targets (null when
+     * a channel tag like `latest` was rolled: then both must report the same
+     * version).
+     */
+    deep(expect: {
+        readonly version: string | null;
+    }): Promise<HealthOutcome>;
+}
+/**
+ * Judge the admin's deep health answer.
+ *
+ * @returns the version the admin runs on success
+ */
+export declare function evaluateAdminDeepHealth(status: number, text: string, expectedVersion: string | null): {
+    ok: true;
+    version: string;
+    detail: string;
+} | {
+    ok: false;
+    error: string;
+};
+/** Judge the gateway's deep health answer against the version the admin runs. */
+export declare function evaluateGatewayDeepHealth(status: number, text: string, expectedVersion: string): HealthOutcome;
+/** Where the probe reaches the install. */
+export interface HealthTarget {
+    readonly provider: "gcp" | "gcp-firebase";
+    readonly projectId: string;
+    readonly domain: string;
+    /** The admin service's `run.app` URL (IAP-gated on gcp-firebase). */
+    readonly adminServiceUrl: string;
+    /** The gateway service's `run.app` URL (public on gcp-firebase). */
+    readonly gatewayServiceUrl: string;
+}
+/**
+ * The origins the probe calls. On gcp the admin's IAP lives on the load
+ * balancer (`admin.<domain>`) and the gateway's ingress is load-balancer-only
+ * (`<domain>/api/*`); on gcp-firebase both `run.app` URLs are reachable — the
+ * admin's through Cloud Run's own IAP, the gateway's publicly.
+ */
+export declare function healthOrigins(target: HealthTarget): {
+    admin: string;
+    gateway: string;
+};
+export interface HealthProbeDeps {
+    readonly run: GcloudRunner;
+    readonly http: HttpFetch;
+    readonly sleep: Sleep;
+    /** Deep-check attempts while the new revisions warm up (default 12). */
+    readonly attempts?: number;
+    /** Pause between attempts in ms (default 5000). */
+    readonly intervalMs?: number;
+    /** Seconds since epoch. */
+    readonly now?: () => number;
+}
+/** The IAP-backed probe of a gcp / gcp-firebase install. */
+export declare function createIapHealthProbe(target: HealthTarget, deps: HealthProbeDeps): HealthProbe;
+//# sourceMappingURL=health.d.ts.map

package/dist/upgrade/health.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"health.d.ts","sourceRoot":"","sources":["../../src/upgrade/health.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAEvD,MAAM,MAAM,aAAa,GACrB;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAC9C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD,MAAM,WAAW,WAAW;IAC1B,iEAAiE;IACjE,QAAQ,IAAI,OAAO,CAAC,aAAa,CAAC,CAAC;IACnC;;;;;OAKG;IACH,IAAI,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC3E;AAuBD;;;;GAIG;AACH,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,MAAM,GAAG,IAAI,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAuC9E;AAED,iFAAiF;AACjF,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,eAAe,EAAE,MAAM,GACtB,aAAa,CAgBf;AAED,2CAA2C;AAC3C,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,QAAQ,EAAE,KAAK,GAAG,cAAc,CAAC;IAC1C,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,oEAAoE;IACpE,QAAQ,CAAC,iBAAiB,EAAE,MAAM,CAAC;CACpC;AAED;;;;;GAKG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,YAAY,GAAG;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAOtF;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,GAAG,EAAE,YAAY,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,KAAK,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,mDAAmD;IACnD,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B,2BAA2B;IAC3B,QAAQ,CAAC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;CAC7B;AAKD,4DAA4D;AAC5D,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,eAAe,GAAG,WAAW,CAqH7F"}